A1Z26 cipher
Swap each letter for its place in the alphabet: HELLO becomes 8 5 12 12 15, and a list of numbers from 1 to 26 turns back into letters. Spaces and punctuation are skipped, and bad numbers are flagged. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- HELLO
- Result
- 8 5 12 12 15
- Calculation mode
- Encode
- Input
- HELLO
- Text
- 8 5 12 12 15
The A1Z26 cipher is the simplest letter-to-number substitution used in puzzle books, escape rooms, classroom worksheets, and CTF warm-ups: each Latin letter maps to its place in the English alphabet, so A is one, B is two, and Z is twenty-six. Encode mode walks your text, maps every A–Z character (case-insensitive) to that position, skips non-letter characters, and joins the numbers with a separator you choose—space by default, or a comma, hyphen, or other delimiter when your worksheet expects a different layout. Empty input is rejected the same way.
How A1Z26 maps letters and numbers
A1Z26 is a public monoalphabetic substitution over the twenty-six Latin letters only. The fixed table is A equals one, B equals two, C equals three, continuing through Z equals twenty-six. There is no key, no modular wrap, and no distinction between upper and lower case on encode: both a and A become one, both z and Z become twenty-six.
Encode mode never invents positions for digits, punctuation, spaces, or non-Latin scripts; those characters are counted as skipped and do not appear in the number stream, which keeps the output a clean list of alphabet ranks. Decode mode is the inverse: each token must parse as a whole number in the closed interval from one to twenty-six.
Values such as zero, twenty-seven, negative signs, decimals, or letters mixed into a token are rejected with a message that names the bad token and its position, because silent clamping would invent false plaintext. Output letters are always uppercase A through Z with no separator between them, which matches textbook answer keys and makes round-trip checks easy: encode a word, then decode the number list with the same separator, and assert equality to the original letters ignoring case.
The cipher is transparent by design—anyone who knows the alphabet can reverse it—so treat it as a puzzle encoding, not as encryption that protects secrets against a motivated reader.
Practical tips, limits, and related searches
Prefer encoding whole words or phrases and letting the tool skip spaces and punctuation so you get a single number stream per phrase; if your puzzle book shows word breaks, encode each word separately or use a distinctive separator between word groups after manual preparation. For decode, always use the same separator the numbers were published with: space-separated lists are the default, while comma-separated worksheets need separator set to a comma so multi-digit tokens such as twelve and twenty-six are not mis-split.
Never omit separators between multi-digit positions—continuous digit runs without a delimiter are ambiguous and will not be auto-segmented. Prefer this capability when you need a transparent, reversible letter-to-position map for demos, worksheets, or puzzle steps; if you need digit-only rotation, use a ROT5 tool instead, and if you need a keyed square cipher, use Playfair or similar. Round-trip checks are straightforward: encode, decode with the same separator, and compare letters case-insensitively to the original Latin characters only.
What you can do with it
Classroom and puzzle worksheets
Teachers and puzzle designers convert short words to A1Z26 number lists, then let students decode back to letters and check answer keys against the uppercase result.
CTF and escape-room warm-ups
Challenge authors hide clue words as space- or comma-separated positions 1–26; solvers paste the numbers with the matching separator and recover the plaintext instantly.
FAQ
What is the A1Z26 cipher?
Numbers convert back to letters the same way. Non-letters are skipped on encode.
How do I decode numbers to letters?
Set mode to decode and provide numbers from 1 to 26 separated by your separator (space by default). The tool returns uppercase letters A–Z.
What happens if a number is outside 1–26?
Only whole numbers from one through twenty-six are valid alphabet positions.
Can I choose a different separator?
Yes. Pass separator (or sep) such as a comma or hyphen. Encode joins with it; decode splits on it. Empty separators are not allowed.
Is the A1Z26 cipher free?
The browser tool is free and runs locally.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/a1z26 \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"HELLO"}'const res = await fetch("https://api.kit.forhosting.com/enc/a1z26", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "HELLO"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/a1z26",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "HELLO"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/a1z26", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"HELLO"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"HELLO"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/a1z26", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "HELLO"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.a1z26",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_chars | 100000 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Decode mode splits the input on the same separator, requires every token to be an integer from one through twenty-six, and returns uppercase letters; any number outside that closed range fails with a clear invalid_input error so bad tokens never silently become garbage characters.
How A1Z26 maps letters and numbers
If the source contains no Latin letters at all, the call fails with invalid_input rather than returning an empty string that could look like a successful no-op.
Calling the API: mode, separator, and response shape
The separator must be a non-empty string no longer than thirty-two characters and is used both to join positions on encode and to split tokens on decode. The text string must be non-empty and must not exceed one hundred thousand characters. Send a JSON body with a required string field named text. Common aliases also accepted by the solver include input, value, data, message, and s, so clients that already label a free-text payload can call this capability without renaming the key. Optional mode defaults to encode and accepts encode or decode (plus short aliases such as enc, dec, to_numbers, and to_letters). Optional separator defaults to a single space; aliases include sep, delim, delimiter, and join. When the separator is whitespace, decode splits on any run of whitespace after trimming the payload. On successful encode the response echoes the original under input, sets both result and text to the joined number string, lists numbers as an integer array, reports letters_encoded and non_letters_skipped, repeats the separator used, and includes formula A equals one through Z equals twenty-six plus a short English message. On successful decode the response sets result and text to the uppercase letter string, lists the parsed numbers, reports letters_decoded, and keeps the same formula field. Failed validation—missing field, empty text, no letters on encode, empty separator, oversize payload, or any number outside one through twenty-six—returns invalid_input and is never charged. Pricing is a flat $0.002 per successful request with unit item and zero marginal unit price.
Practical tips, limits, and related searches
Keep payloads under the published maximum length so Worker memory stays bounded. Failed tasks that return invalid_input do not consume prepaid balance, which keeps exploratory scripts cheap when clients probe empty fields or out-of-range numbers.
Integration use cases
Pipeline tests for letter-rank maps
Test suites assert A maps to 1 and Z to 26, round-trip encode then decode, and include an out-of-range number fixture that must return invalid_input.